Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    active directory + freeradius + ldap + captive portal

    Scheduled Pinned Locked Moved
    Turkish
    2
    6
    1.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      ciscolog
      last edited by

      AD + freeradius + ldap üçlüsünü bir türlü bağlantı kuramadım captive portal ile Ad user deniyorum fakat hata aliyorum
      configurasyon şu şekilde
      büyük ihtimalle
      identity
      base_dn
      filter
      groupdada membership filter membership attribute ayalarında bir problem var daha önce deneyip başarılı olan varmı ?

      /usr/local/etc/raddb/mods-enabled/ldap
      ldap {
      server = "192.168.2.100"
      port = "389"
      identity = "cn=freeradius.user,dc=dclocal,dc=local"
      password = '12345678'
      base_dn = "dc=dclocal,dc=local"

      user {
	base_dn = "${..base_dn}"
	filter = "(&(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}))"
	### access_attr = "dialupAccess" ###
}
group {
	base_dn = "${..base_dn}"
	filter = '(objectClass=posixGroup)'
	name_attribute = cn
	membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))"
	membership_attribute = memberOf
	compare_check_items = yes
	do_xlat = yes
	access_attr_used_for_allow = yes
}
profile {
	filter = "(objectclass=radiusprofile)"
	### default_profile = "cn=radprofile,ou=dialup,o=My Company Ltd,c=US" ###
	### profile_attribute = "radiusProfileDn" ###
}
      1 Reply Last reply Reply Quote 0
      • M
        magokbas
        last edited by magokbas

        vi editorunu kullanmayı biliyorsanız;

        vi /usr/local/pkg/freeradius.inc dosyasını açın 'authorize {' aramasını yapın. 3 tane bulacaksınız. bunlardan
        {$varsqlconfauthorize}
        # smbpasswd

        satırlarını bulup # smbpasswd altına aşağıdaki kodu yapıştırıp kaydedip çıkın.

        ldap
        if ((ok || updated) && User-Password) {
        update control {
        Auth-Type := ldap
        }
        }

        daha sonra freeradius servisine gidip tekrar ldap sekmesini kaydedin. çalışacaktır.

        C 1 Reply Last reply Reply Quote 0
        • C
          ciscolog @magokbas
          last edited by ciscolog

          @magokbas said in active directory + freeradius + ldap + captive portal:

          vi editorunu kullanmayı biliyorsanız;

          vi /usr/local/pkg/freeradius.inc dosyasını açın 'authorize {' aramasını yapın. 3 tane bulacaksınız. bunlardan
          {$varsqlconfauthorize}
          # smbpasswd

          satırlarını bulup # smbpasswd altına aşağıdaki kodu yapıştırıp kaydedip çıkın.

          ldap
          if ((ok || updated) && User-Password) {
          update control {
          Auth-Type := ldap
          }
          }

          daha sonra freeradius servisine gidip tekrar ldap sekmesini kaydedin. çalışacaktır.

          maalesef çalışmadı hocam
          hata şu şekilde

          Dec 4 15:31:43 radiusd 31186 rlm_sql (sql1): Opening additional connection (6), 1 of 4 pending slots used
          Dec 4 15:31:43 radiusd 31186 rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 65 seconds
          Dec 4 15:31:43 radiusd 31186 rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 65 seconds
          Dec 4 15:31:43 radiusd 31186 rlm_ldap (ldap): Opening additional connection (2), 1 of 5 pending slots used
          Dec 4 15:31:43 radiusd 31186 gethostby*.getanswer: asked for "ForestDnsZones.dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:44 radiusd 31186 gethostby*.getanswer: asked for "DomainDnsZones.dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:44 radiusd 31186 gethostby*.getanswer: asked for "dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:44 radiusd 31186 Need 4 more connections to reach min connections (5)
          Dec 4 15:31:44 radiusd 31186 rlm_ldap (ldap): Opening additional connection (3), 1 of 4 pending slots used
          Dec 4 15:31:44 radiusd 31186 Need 1 more connections to reach min connections (3)
          Dec 4 15:31:44 radiusd 31186 rlm_sql (sql1): Opening additional connection (7), 1 of 3 pending slots used
          Dec 4 15:31:44 radiusd 31186 (1) Login incorrect (Failed retrieving values required to evaluate condition): [xxxxxxxxx] (from client QHOTSPOT port 0)
          Dec 4 15:31:52 radiusd 31186 gethostby*.getanswer: asked for "ForestDnsZones.dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:52 radiusd 31186 gethostby*.getanswer: asked for "DomainDnsZones.dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:52 radiusd 31186 gethostby*.getanswer: asked for "dclocal.local IN AAAA", got type "HINFO"
          Dec 4 15:31:52 radiusd 31186 Need 3 more connections to reach min connections (5)
          Dec 4 15:31:52 radiusd 31186 rlm_ldap (ldap): Opening additional connection (4), 1 of 3 pending slots used
          Dec 4 15:31:52 radiusd 31186 (2) Login incorrect (Failed retrieving values required to evaluate condition):

          1 Reply Last reply Reply Quote 0
          • M
            magokbas
            last edited by

            @ciscolog said in active directory + freeradius + ldap + captive portal:

            cn=freeradius.user,dc=dclocal,dc=local

            cn=freeradius.user,dc=dclocal,dc=local

            bu sizin tanımladığınız freeradius.user hangi ou altında bulunuyor. Users altında ise onu da tanımlamanız gerek.

            Örnek : cn=freeradius.user,cn=Users,dc=dclocal,dc=local

            Bir de Filter kısımına şununla deneyin : (SAMAccountName=%{mschap:User-Name})

            C 1 Reply Last reply Reply Quote 0
            • C
              ciscolog @magokbas
              last edited by ciscolog

              @magokbas said in active directory + freeradius + ldap + captive portal:

              @ciscolog said in active directory + freeradius + ldap + captive portal:

              cn=freeradius.user,dc=dclocal,dc=local

              cn=freeradius.user,dc=dclocal,dc=local

              bu sizin tanımladığınız freeradius.user hangi ou altında bulunuyor. Users altında ise onu da tanımlamanız gerek.

              Örnek : cn=freeradius.user,cn=Users,dc=dclocal,dc=local

              Bir de Filter kısımına şununla deneyin : (SAMAccountName=%{mschap:User-Name})

              yok hocam çalışmıyor maalesef

              sizin söylediğinizi yazmama rağmen filter la ilgil ihata veriyor bir sürü kombinasyon denedim banamısın demedi
              farklı filtre denesem şu hatayı veriyor

              rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 52e, v3839.

              rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
              rlm_ldap (ldap): Opening additional connection (0), 1 of 5 pending slots used
              rlm_ldap (ldap): Connecting to ldap://192.168.2.100:389
              rlm_ldap (ldap): Waiting for bind result...
              rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
              rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 52e, v3839.
              rlm_ldap (ldap): Opening connection failed (0)
              (0) [ldap] = fail
              (0) } # redundant = fail
              (0) } # authorize = fail

              C 1 Reply Last reply Reply Quote 0
              • C
                ciscolog @ciscolog
                last edited by

                @ciscolog said in active directory + freeradius + ldap + captive portal:

                @magokbas said in active directory + freeradius + ldap + captive portal:

                @ciscolog said in active directory + freeradius + ldap + captive portal:

                cn=freeradius.user,dc=dclocal,dc=local

                cn=freeradius.user,dc=dclocal,dc=local

                bu sizin tanımladığınız freeradius.user hangi ou altında bulunuyor. Users altında ise onu da tanımlamanız gerek.

                Örnek : cn=freeradius.user,cn=Users,dc=dclocal,dc=local

                Bir de Filter kısımına şununla deneyin : (SAMAccountName=%{mschap:User-Name})

                yok hocam çalışmıyor maalesef

                sizin söylediğinizi yazmama rağmen filter la ilgil ihata veriyor bir sürü kombinasyon denedim banamısın demedi
                farklı filtre denesem şu hatayı veriyor

                rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 52e, v3839.

                rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
                rlm_ldap (ldap): Opening additional connection (0), 1 of 5 pending slots used
                rlm_ldap (ldap): Connecting to ldap://192.168.2.100:389
                rlm_ldap (ldap): Waiting for bind result...
                rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
                rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 52e, v3839.
                rlm_ldap (ldap): Opening connection failed (0)
                (0) [ldap] = fail
                (0) } # redundant = fail
                (0) } # authorize = fail

                yukardaki hataları geçtim bir aşadağıki hatalar var onları geçemiyorum

                (0) ERROR: Failed retrieving values required to evaluate condition

                (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
                (0) pap: WARNING: Authentication will fail unless a "known good" password is available

                (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post